Unconditional security of the Bennett 1992 quantum key-distribution scheme with 

strong reference pulse 
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We prove the unconditional security of the original Bennett 1992 protocol with strong reference 
pulse. We show that we may place a projection onto suitably defined qubit spaces before the receiver, 
which makes the analysis as simple as qubit-based protocols. Unlike the single-photon-based qubits, 
the qubits identified in this scheme are almost surely detected by the receiver even after a lossy 
channel. This leads to the key generation rate that is proportional to the channel transmission rate 
for proper choices of experimental parameters. 



I. INTRODUCTION 

Quantum key distribution (QKD) is an art to dis- 
tribute a secret key between parties (Alice and Bob) with 
arbitrary small leakage of its information to an unautho- 
rized party (Eve). So far, several QKD protocols have 
been proposed and experimentally demonstrated In 
real life QKD, loss and noises in the quantum channel 
limit the achievable distance. In order to cover longer 
distances, a decoy state idea for BB84 [2j with weak co- 
herent pulses was proposed, which achieves a key genera- 
tion rate of order 0(n) 3] in the single photon transmis- 
sion rate 77, whereas it is in the order of 0(r] 2 ) without 
decoy states 

Another proposal to achieve longer distances was made 
in 1992 by Bennett [5] (B92). The protocol uses two 
weak coherent states together with a strong reference 
pulse (SRP), and is expected to be robust against channel 
losses. In contrast to the decoy schemes where the robust- 
ness is achieved by using an increased number of states, 
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FIG. 1: (a) An experimental setup for the B92 protocol with 
strong reference pulse. PM: phase modulator, (b) An equiv- 
alent setup for Bob. 



'Electronic address: tamaki@will.brl.ntt.co.jp 



the B92 protocol uses just two states, and hence its ro- 
bustness should come from an entirely different mecha- 
nism. Unconditional security was proved [|| for a variant 
of the B92 protocol using two polarization states of a sin- 
gle photon, which we call S-B92, but it does not share 
the robustness expected for the original B92. The secu- 
rity proof of the original B92 protocol is thus important 
from the practical viewpoint as well as the fundamental 
one. 

In this paper, we prove the unconditional security of 
the original B92 protocol, and reveal the mechanism with 
which its robustness against loss arises. The crucial find- 
ing is that the B92 protocol can be regarded as many 
S-B92 protocols executed in parallel, which has two ben- 
efits. Firstly, it allows us to use the analysis of S-B92 
in proving the security of the B92 protocol. Secondly, a 
striking difference from S-B92 tells us why the B92 pro- 
tocol is robust against loss and performs similarly to an 
ideal single-photon implementation of the BB84 protocol. 

In two-state protocols, it is known that by exploit- 
ing an unambiguous state discrimination (USD) measure- 
ment, Eve can obtain a benefit from qubit loss events pj. 
Thus, a secure key is impossible over longer distances in 
S-B92 6] , where qubit loss events are directly connected 
to physical channel loss. On the other hand, the qubits in 
the B92 protocol turn out to be defined including a vac- 
uum component in the signal mode, and they are almost 
always received by Bob even after traveling over longer 
distances. In other words, the qubit loss events are neg- 
ligible since it is not directly connected to the physical 
channel loss. 

This paper is organized as follows. In Sec. II, we ex- 
plain how the B92 protocol works, and in Sec. Ill, we 
prove its security. Our security proof is based on the 
conversion to an entanglement distillation protocol, and 
our proof uses technique from the security proof of S- 
B92. Thus, in Sec. Ill A, we briefly review the security 
proof of S-B92 @, then in Sec. Ill B, III C, and III D, we 
intuitively present the security proof of the B92 protocol, 
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putting some emphasis on the difference between S-B92 
and the B92 protocol. We leave the technical details of 
the proof to the appendices. Finally, we show some ex- 
amples of the resulting key generation rate in Sec. IV, 
and we summarize this paper in Sec. V. 



II. B92 PROTOCOL WITH STRONG 
REFERENCE PULSE 

The essence of the experimental setup of the B92 pro- 
tocol can be expressed by a Mach-Zchnder interferome- 
ter in Fig. [Ha) . Alice generates a strong coherent pulse 
and splits it into a weak signal pulse \\/~k)s and an SRP 
IVTOsrp { K "C /i). After Alice applies a phase modu- 
lation to prepare |(— l)*-^/re)s according to her random 
bit i = 0, 1, she sends out these two systems. Bob uses a 
beam splitter BS1 with reflectivity R = fc//i, which splits 
the SRP into weak and strong pulses. The weak pulse 
(W) and the signal pulse interfere at BS2, whose action is 
represented by bj — 4^ (aw + (— l^'as) (j — 2, 3), where 

bj and a-yv/S are annihilation operators for the spatial 
mode to the detector Dj and the W/S mode, respectively. 

For Bob's part, we assume two types of detectors. One 
type can tell if the photon number v is in an interval 



A ( Dl 



,Vf - 1], 



(1) 



and the other type can discriminate among vacuum, 
single-photon, and multi-photon events. We note that 
one of us [?J proved the security of a modified B92 with 
threshold detectors, but there Bob must lock his own lo- 
cal oscillator to the SRP mode via a feed-forward control, 
which may not be easy to implement. In Fig. [lja), Bob 
infers Alice's bit value to be (1) when D2 (D3) records a 
single photon and D3 (D2) records no photon. Let Ag^n 
be the rate of these conclusive events. Here and hence- 
forth, "rate" is always normalized by the total number 
of signals. Among the conclusive events, only the cases 
where the outcome of Di is in \( Dl ^ will be kept and used 
to generate the final key after classical error correction 
(EC) and privacy amplification (PA) Q. Let Ag^x' be 
the rate of these events, where 



A' 



(2) 



corresponds to the range of the total number of photons 
recorded by the three detectors. Using random test bits, 
Alice and Bob monitor the error rates Abit,aii and Abit,A' 
of the cases where Alice's bit and Bob's bit are different. 
Bob also monitors the rate A vac A ( Dl > of events where both 
D2 and D3 record no photon and Di reports an outcome 
in A( Dl ). Note that in the normal operation with 77 <C 1 
and A^ Dl ^ being wide enough, we should have Agi^i = 
Agi.A'j Abigail — Abit,A', and A vac A(Dl ) = A raCia n = 1, but 
these three rates must still be monitored to watch out for 
Eve's possible attacks as we will see later. 



III. SECURITY PROOF 

In this section, we prove the security of the B92 proto- 
col. Throughout this paper, we assume that all imperfec- 
tions are controlled by Eve. Note that Di with quantum 
efficiency 7/1 and D 2 (D 3 ) with 7/ are equivalent to the 
setup with unit-efficiency detectors when absorbers with 
the transmission rate of 77' and 77" = i??7' + (1 — R)r]i are 
respectively put in S and SRP modes, and the reflectiv- 
ity of BS1 is changed to Rr)'/(Rr]' + (1 - R)r]i). As for 
dark counts, we assume Eve can induce dark counts as 
she pleases. Thus, in what follows we assume that all 
detectors have unit efficiency and no dark counts. 

Since the B92 protocol and S-B92 share many similar- 
ities, in the security proof of the B92 protocol we em- 
ploy the idea from security proof of S-B92. In the next 
subsection, we briefly review S-B92 security proof. It is 
based on the conversion of the protocol to an entangle- 
ment distillation protocol. After the review, we present 
the security proof of the B92 protocol. 



A. Review of B92 with single-photon 
implementation 

In S-B92, Alice sends out \tp,) = f3\Q x ) + (-l)*a|l x ) 
(a 2 + [3 2 = 1 and (3 > a > 0) depending on randomly 
chosen bit value i — 0,1, where lO^) and 1 1^,) repre- 
sent a basis (X-basis) of the qubit states (the single- 
photon polarization states). For later convenience, we 
define the Z-basis as \i z ) = (\0 X ) + (-iy\l x ))/V2, and 
P(|</>)) = \4>){4>\- When Bob receives a qubit state, he 
broadcasts this fact and continues to perform a mea- 
surement described by positive-operator-valued measure 
(POVM) @] 

F = (G/2)P(|^)) 
Fi = (G/2)P(\lp )) 



-Fnull — 1 — Fq — Fi 



(3) 



where G = {j/f3) 2 , < 7 < 1, and |^) = a\0 x ) - 
(— l) l [3\\ x ) is the state orthogonal to \(pi). We call mea- 
surement outcomes with Fo or F% conclusive. Bob tells 
over a public channel if he has obtained the conclusive 
event or not. 

In order to prove the security of S-B92, in 6] S-B92 
was converted to an entanglement distillation protocol 
(EDP). A key point in the conversion is that Bob's mea- 
surement can be decomposed by a filtering operation [§] , 
whose successful operation is represented by a Kraus op- 
erator [8( 



(4) 



A s =VG[aP(\0 x ))+f3P(\l x ))] 



followed by Z-basis measurement. This can be seen by 
noting that Fi = P(A s \i z )), and the successful filtering 
operation corresponds to the conclusive event in S-B92. 
On the other hand, we assume that Alice prepares two 
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qubits in a state |$) s = ^(\0 Z ) a\<Po)b + |1»)a|¥>i)b), 
sends only qubit B to Bob, and then performs Z-basis 
measurement on qubit A. In the normal operation with- 
out Eve, the successful filtering operation orthogonalizes 
\(Po)b and \ipi)B so that they share a maximally entan- 
gled state, and the bit value shared by Alice and Bob via 
Z-basis measurements is secure. 

In the presence of loss, noise, or Eve's intervention, Al- 
ice and Bob do not share a maximally entangled state, 
but if they succeed in estimating the bit and the phase er- 
ror rate on the qubit pairs from which they create the key, 
then they can distill an almost perfect maximally entan- 
gled state by running an EDP. Here, the bit (phase) error 
stands for an event where Alice and Bob have different 
measurement outcomes in Z-basis (X-basis). Moreover, 
if we use the argument by Shor and Preskill [l(|, the 
EDP protocol followed by Z-basis measurements can be 
made equivalent to S-B92 with EC and PA. Since the bit 
error rate A^it can be reliably estimated from test bits, 
we are only left with the estimation of the upper bound 
on the phase error rate A p h from the observed variables. 
Thanks to the filter, we can actually relate this bound 
with other observables. When the photon reaches Bob 
at rate A s and gives a conclusive outcome at rate Agi, it 
was shown in [6| that 



A fil -2A bit <2Ga/? ff (CZ) : 



(5) 

where g((a,b,c,d) T ) = ^/ad + Vbc, Z = 
(A s , Ai x , Afii, A p h) T , and the matrix C is the inverse of 



c- 1 = 



/ 1 1 1 1 

11 

Go? G0 1 Go? G0 1 

V G0 1 Go? 



(6) 



The quantity k\ x is the rate at which Bob receives the 
photon and Alice's qubit A is in state II^a- Although 
k\ x is not measured in the protocol, we have a bound 
o? — 1 + A s < K\ x < a 2 . Using this, the bound on A p h 
can be obtained by solving Eq. ([5]). 

The key rate resulting from the above formula is 
nonzero only for short distances [6( . For a high loss region 
with small rate A s , Eve may perform the USD measure- 
ment on the incoming two states. Whenever it fails, she 
blocks the photon as if it were lost due to the channel 
loss. If the USD is successful, she can send the correct 
state to Bob and hence she learns the bit value without 
inducing any error. It follows that any two state protocol 
is fragile against qubit loss events. Note that the qubit 
loss events is not always connected directly to the physi- 
cal channel losses, which is the case for the B92 protocol 
as we will see. 



B. Conversion of the B92 protocol into an 
entanglement distillation protocol 

In this subsection and the subsequent ones, we prove 
the security of the B92 protocol. Especially, this subsec- 



tion is devoted to a conversion of the B92 protocol into 
an entanglement distillation protocol, which is the most 
crucial point in our proof. 

Our strategy for the proof is to apply a similar argu- 
ment to the original B92 with SRP, i.e., we consider the 
distillation of the maximally entangled state. For the dis- 
tillation, we first have to convert Alice's and Bob's part 
in such a way that each of them has a qubit. Then, we 
consider the phase error estimation by modifying Eq. (1). 
Alice's part can easily be converted by letting her first 
prepare |tf> = ^ (\0 Z ) A \^) S + |1,)a|-v^>s) IVa*)srp 
and measure the qubit A on the Z basis. 

On the other hand, the conversion of Bob's part is not 
straightforward since the definition of his qubit space is 
by no means trivial. For the conversion, we first intro- 
duce additional fictitious measurements which do not dis- 
turb Bob's conclusive data at all. Thus, the security of 
the final key does not change even if we assume that Bob 
has conducted these additional measurements. As we will 
see, these measurements consist of a total photon num- 
ber measurement (P) and a qubit projection (Q). Fur- 
thermore, as we did in Sec. MI Al for the S-B92 protocol, 
we decompose Bob's original measurement into a filter- 
ing operation (F) followed by a projection measurement 
(M) (see Fig. QIb)). Here, the qubit space is defined by 
combining the vacuum state and the single-photon state 
of the S-mode with the appropriate Fock states of the 
SRP mode depending on the outcome of measurement P. 
Our qubit space is thus defined depending on the total 
photon number. This total photon number determines 
the nonorthogonality in Bob's measurement. 

Now, let us present the conversion of Bob's part in 
detail. First, define \v' ,v — i/)b = I^OsI^ — v')skp as 
the state with v' photons and v — v' photons in mode 
S and SRP, respectively. Since Bob uses only linear 
optics and photon detectors, it does not disturb the 
statistics of Bob's measurement outcomes to assume 
that Bob's measurement is preceded by the measurement 
of the total photon number v in modes S and SRP. 
We denote this measurement as "P", whose POVM is 

{Sfe+fe'= l /-P(l^' fc/ )B)} l /=o,i, - - Suppose that v > is 
obtained in this measurement, and recall that Bob's 
conclusive events occur only when D2 and D3 receive one 
photon in total. Then, it follows that without any dis- 
turbance of the statistics of the conclusive events, P can 
be followed by projection measurement "Q" with POVM 



=0.1 



*)b),E^= 



2,3, 



Here, Q decides if the state is in the qubit subspace THy 1 ' 

spanned by \Q x "')b = |0, v)b and \1^)b = 1)b- 

Under the condition that the total number of photons 
was v, let us calculate the POVM element for ob- 
taining conclusive bit i. At BS1, conversion |0, v)b 
|0}s I l)w |^ — 1)di occurs with probability (1 — R)"~ 1 vR, 
and |l,i/-l) B -> |l)s|0)wk - 1)d x with (1 - R)"- 1 . 
Since outcome i corresponds to the projection to state 
(|0) s |l)w + (-l)il)s|0) w )/\/2, we have 

= (G tf /2)P(a„|0M) B + (-l)%|lM) B ) (7) 
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with G v = (1 - Ry-^l + vR), a v = y/vR/(l + vR), 
and /3 V = \/l/(l + vR). At this point, we notice that 
the measurement on each qubit space is the same as the 
measurement in S-B92 with (G, (3, a) — > (G„, f3 v ,a u ), and 
hence we can define the filter accordingly. The success- 
ful filtering operation converts I3 V \0^) ± a^lli^) into 
orthogonal states, and it is described by 

1M = ^KP(|0H)) + A,P(|lM»] . (8) 

Physically, the conversion is realized by BS1 and [y — 
l)-photon detection by Di, resulting in (|0)s|l)w ± 
|l)s|0)w)/v / 2- Thus, we conclude that Bob's measure- 
ment can be decomposed into the sequence of P, Q, and 
the filtering operation (F) followed by a projection mea- 
surement on a qubit. 

Note that in the B92 protocol we distill a key from 
the successfully filtered events (or the conclusive events) 
with total photon number v € A'. Thus, by following the 
argument by Shor and Preskill, we conclude that once we 
have the estimation of an upper-bound on the phase error 
rate with total photon number v S A', i.e., Aph.A'/A-m.A', 
we complete the security proof. 

C. Comparision to the single-photon 
implementation 

S-B92 and our B92 are similar in the sense that Bob ap- 
plies a filter that orthogonalizes two nonorthogonal qubit 
states. However, the two schemes differ in the structure 
of the qubit spaces and the effect of optical loss (repre- 
sented by channel transmission r\) on them. In the S-B92 
protocol, the loss of the photon means that Bob fails to 
receive a qubit. On the other hand, when the photon 
reaches Bob, the nonorthogonality of the two received 
states is the same as that of the two states released from 
Alice. Hence the initial states of Alice and the measure- 
ment by Bob are described by the same parameter a. 
The loss of the qubit is fatal to the key rate, since Eve is 
able to let Bob receive a qubit preferentially in the cases 
where she has succeeded in discriminating the states in 
the USD measurement. In the B92 protocol, by contrast, 
Bob almost always receives a qubit H M : He only fails 
when v is outside of A' or when Q fails the qubit pro- 
jection, both of which are negligible if A' is chosen to be 
wide enough and t/k -C 1. This prevents Eve from forcing 
Alice and Bob to accept the events favorable to her. 

The effect of the optical loss in the B92 protocol shows 
up in an entirely different place. To see this, let us rewrite 
Alice's initial coherent states as |±y / k)s = /3|+)s ±ct| — )s 
with 

a 2 = (1 - e- 2K )/2, (9) 

where |-(-)s and |— )s are a pair of orthonormal states 
obtained by normalizing \\/~k) ± \—^JH). Since A' is cen- 
tered around rgi and R is chosen such that r]fiR = rjn, we 
have o? v ~ r\n whereas a 2 ~ k for k <C 1. Hence in the 



B92 protocol, the optical loss decreases the distinguisha- 
bility of the two signal states sent out from Alice. Eve 
can exploit this difference to obtain partial information 
on the bit value, but this time she has no further free- 
dom to manipulate Alice and Bob, since the qubit must 
be almost always received by Bob. We may thus expect 
that the key gain is still positive after the privacy ampli- 
fication even for lossy quantum channels, which will be 
confirmed in the subsequent sections. 

Another complication in the B92 protocol is that it 
looks as if we run slightly different S-B92 protocols with 
parallel qubit channels, for each of which Bob has a filter 
with a nonorthogonality specified by v. Since this varia- 
tion might be exploited by Eve, it is desirable to choose 
A' to be narrow. As we have seen, on the other hand, 
A' must be much wider than photon number fractuation 
(~ y/VP) m the SRP. Due to this trade-off, it is expected 
that the key rate also depends on the intensity /1 of SRP. 

D. The phase error estimation 

Since the formal derivation of the upper bound of the 
phase error rate is a bit complicated, in the main text we 
intuitively present the derivation and we leave the formal 
derivation to Appendices. From the relation to S-B92 we 
have seen above, it follows that Eq. ([5]) holds for each 
photon number v, namely, 

A m , v - 2A biti „ < 2G u a v p v g{C v Z v ) . (10) 

Here, we have used a straightforward translation of the 
parameters in S-B92 into those in the B92 protocol as 

(Am, A W t, G, /3, a) — > (A^, A b it,^, G v , (3 V , a v ) (11) 

and 

Z = (A s , Ais, Afii,A ph ) T 

— > Z„ = (A Si „, K\ XiV , Am,,, A p h^) T (12) 

Note that g(u) is concave and g is monotone increasing 
for each element of u. Taking the summation over the 
range vgA, where 

AsA^UA^Ki//], (13) 

and noting that G„av/3„ < G Vj a Vf j3 Vf , we have 

Afli, A - 2A bit , A < 2G Vf a Vf p Vf g{C'Z x ) (14) 

with Z A = (A s ,a, Ai^a, A fl i,A, A phiA ) T and C = 
max„ 6 AGi,, where the maximum is taken for each ele- 
ment. 

Since we have used Eq. ([5]) from S-B92 argument 0], 
Eq. (TTJJ holds true in the asymptotic limit in which the 
block size for each photon number v is large. As we 
show in Appendix B, with a more detailed analysis using 
Azuma's inequality [ill, Ell' we can show that it holds 
true if the total block size is large. 
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Finally, we must convert Eq. (fT4f into one involv- 
ing only the accessible quantities. As we show in Ap- 
pendix B, Eqs. (B10)-(B13), Z\ is upper-bounded by 
Zjj = (I, a 2 , Afii )a u, Aph !A ) T . A lower bound is given 
by Z L = (fix, a 2 - 1 + fj\, A m ,x>, A p h,A) T with fix = 
A vac A (D!) + Afii^'- Since the vacuum events are domi- 
nant in the high loss region, fjx is almost unity, implying 
that the qubit loss events are negligible. This makes our 
B92 robust against channel losses. Using these bounds, 
we can rewrite Eq. (|14jl into 




A 



fil.A' 



2A 



bit, all 



< 2G Vf a Vf V/ g(C' + Z u - C'_Z L ) , (15) 



where we have decomposed C = C' + — C'_ such that C' + 
includes only the nonnegative entries of C An upper 
bound of the phase error A p h,A' is determined by inserting 
the experimental data into Eq. (fTS"]) and searching for 
the maximum value of A p h,A satisfying Eq. (|15[) . since 
A p h,A' < A pv , _x by definition. The key generation rate is 
given by [10j | 



G kcy = Max(0, A 



fil.A' 



1 



h{ *ut 2 x L] _ h 



A 



fil.A' 



A 



P h,A' 



A 



fil,A' 



(16) 



where h(x) = — xlog 2 x — (1 — x) log 2 (l — x). 



IV. KEY GENERATION RATE 

To illustrate the resulting key rates, we consider a 
quantum channel that maps P(|±y / K)s|y / /i)sRp) into 

(1 -p)P(|±V^)s|Vw)srp) +pP(|l)s| VW)srp). Here 
|l)s is a single photon state and < p < 1. The first part 
models loss with transmission rate 77, and the second part 
models dark counts since a single photon state causes a 
random click on Bob's detectors D2 and D3. In order to 
express the experimental parameters, we define I as the 
distance between Alice and Bob, £ as a loss coefficient, 
and ?7Bob as Bob's detection efficiency. We take the ex- 
perimental parameters from Gobby et al [13j |. which are 
p = 1.7 x 1(T 6 , £ = 0.21 (db/km), and r^ob = 0.045 
neglecting alignment errors. With these parameters, we 
have 

A fil , a ii = e- 2 ^2i 1 K(l~p) + e-^p, 
V = KT^Bob, 

Afiball ( V ) ' 



Afil.A' 
^vac,A< D i) 
Abit,A' 



50 75 100 125 150 
Distance (km) 



FIG. 2: The key generation rate. See the main text for the 
explanations. 



(/1, k, a), where i>i = rjp — a^/ffjl, and Vf = r)\i + a^Jfjjl. 
In Fig. [21 we fix k = 10 -0 92 and a = 3.2, and vary 
fi as (a) p = 10 5 resulting in l a — 55, (b) n = 10 6 59 
(/ a = 100), and (c) p = 10 10 (/ a = 122). This con- 
firms our earlier speculation that increasing p will restrict 
Eve's options and leads to a better key rate. The slope 
of curve (c) shows that the key rate is proportional to 
the channel transmission 77 until the distance approaches 
l a . Increasing /1 further beyond (c) merely results in 
saturation at l a — 124, and this is the maximum dis- 
tance among the combinations of the parameter set that 
we have tried. We can also trade the intensity of SRP 
for a poor resolution a. For example, with p — 10 7 we 
can still achieve l a = 100 even with a relative resolution 
|A (Dl) |/V~ 10%. 

To see how accurate our phase estimation is, we plot 
Gkcy (dashed line) based on the actual phase error rate 
induced by the quantum channel. The curve is almost 
identical for (a), (b) and (c), implying that the key rate 
dependence on \x is due to the difference in the estimation 
ability. This is a typical feature of the B92 protocol in 
which the phase error rate cannot be estimated directly 
as opposed to the BB84 protocol. We must also note that 
the derivation of Eq. (fT5)) from Eq. (O is not tight and the 
estimation might be improved by a more sophisticated 
analysis. 

For comparison, we have also shown the key rate for the 
BB84 protocol based on the GLLP formula [3 (dotted 
line, Z a = 51), and the rate with infinite number of de- 
coy states [H (dotted line, l a — 163), assuming the ideal 
error correction efficiency. Considering that the analysis 
of the statistical fluctuations in the decoy schemes tends 
to be very complicated Q , achieving a comparably long 
distance with just two states could be an advantage of 
the B92 protocol in practical implementations. 



iy£A( D l) 



J2 P v(n- K )(v)> (17) 



i/GA< D i) 



— „ — x x 



where P x {v) 

We have calculated the key rate Gk cy and the achiev- 
able distance l a (km) for several choices of parameters 



V. SUMMARY 

In summary, we studied the security of the original 
B92 with strong reference pulse assuming the two types 
of detectors. We can identify qubit spaces composed of 
the states with the signal pulse including zero and one 
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photon. It follows that even if the transmission channel 
is physically very lossy, Bob still finds a qubit state with 
high probability, which is the essential difference from 
the single-photon B92. We showed the key rate scales 
as Gkey ~ 0(rj) when the SRP is strong enough. It is 
interesting to remove the assumptions on the detectors, 
which we leave for future studies. 
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APPENDIX A: AZUMA'S INEQUALITY 

In the following appendices, we explain the formal 
derivation of the phase error estimation, Eq. (fT5"|) . As 
we have mentioned in the main text, we need to obtain 
the relationship among A b it,A, Afii,A, A ph ,A, Ai^Ai and 
A s \ . For the derivation of the relationship, we have two 
problems to be addressed. First, note that these ratios 
cannot be directly measured in the experiment. For in- 
stance, in the actual experiment we have direct access to 
Afii.v, not Agi^. Thus, Agi^ has to be estimated via ac- 
tually available experimental data. This is also the case 
for other ratios, such as Abit,A> h~i x ,\> an d A s ,a, and the 
estimation will be discussed in Appendix C. 

In addition to this problem, we have another difficulty 
in deriving the relationship. The difficulty lies in the fact 
that not all the observables can be simultaneously mea- 
sured. For example, Ax^a and Abit,A do not commute 
because Alice has to conduct X-basis measurement for 
Ai xj a while she performs Z-basis measurement for Abit.A- 
In order to overcome this problem, we randomly label 
each pair as a test pair (with a small probability t) or a 
code pair (with probability 1 — t) [l5| • We try to distill 
a key from the code pairs, and hence what we need to 
estimate is the phase error rate A p h _\ in the code pairs. 
By using the Bell measurement [16], Abit,A and A p h,A in 
the code pairs can be measured simultaneously, in prin- 
ciple. On the other hand, for the test pairs, we assume 
that Alice performs X-basis measurement on her qubits 
to measure Ai In this way, all the observables can be 
measured simultaneously, and we can clearly define joint 
probabilities. This is where Azuma's inequality, which 
connects conditional probabilities with the actual ratios, 
comes into our game. 



FIG. 3: The measurement diagram. 



In order to claim that the above fictitious senario is 
possible in principle, the actual protocol must be slightly 
modified. The labeling of test pairs and code pairs should 
be publicly done in the actual protocol. The key is dis- 
tilled only from the code pairs, while Alice discards her 
bit values for the test pairs, such that she could have 
performed X-basis measurement on her fictitious qubits. 
The only parameters we actually need to monitor for the 
test pairs is the number of events where zero or one pho- 
ton are recorded by Di and D3 in total, with the outcome 
of D\ being in the valid range Xd x ■ This quantity is used 
in Eq. (C5) below. 

Now let us describe our argument for the phase er- 
ror estimation precisely. Imagine a sequence of measure- 
ments on a pair of systems, A and (S,SRP), which Alice 
and Bob share (see also Fig. [3]). At the beginning, Al- 
ice randomly decides whether a pair is a test pairs (with 
probability t) or a code pairs (with probability 1 — t), and 
for the code pair, the sequence of measurements starts 
with "P" with outcome v, followed by projection "Q" . If 
P fails to detect photon number inside A or Q does not 
succeed in projecting the state to the qubit state THS V \ 
we call such outcome as "N" . If the state was found in the 
qubit state with P detecting photon number inside A (we 
call this outcome "s"), we subject the state to the filter- 
ing operation F. If F succeeds ("fil"), we apply the Bell 
measurement [8j ( "B" ) to see whether there is a bit error 
("bit") and/or a phase error ("ph"). If F fails ("fail"), 
we simply discard it. 

On the other hand, for the test pairs Alice performs X- 
basis measurement on Ha, and Bob conducts the afore- 
mentioned "P" measurement and the projection "Q" . As 
a result, we have four possible outcomes, X As, l x A s, 
X A N, and l x A N. 

Consider N such pairs of systems, and imagine that 
we repeat this set of measurements from the I s * pair in 
order. Let be the path that was actually taken by 
the k th pair. For S {bit, ph, fil, l x A s,s}, define 
as the number of the pairs whose path include {Q, v} 
among the first I pairs. Furthermore, we define as 
X^ga "^nw an d specifically we write To, a = A- With 
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these parameters, we define 
Tn a 



POVM element Pn,A = X^eA P(i,v is defined as follows. 



Ao, A 
An a 



N(l-t) 

To. A 



for Jl = s, fil, ph, bit 



Nt 



for f2 = ljc A s . 



(Al) 



Our task is to derive a bound on A p h,A as a func- 
tion of other An^'s that can be estimated from the 
data available in the actual protocol. To do so, we 
invoke the fact that we can assign a joint probability 
P pa th({£^}fc=i,...A r ) for every attack by Eve, since all 
{£( fe )} can be measured at the same time. Then, we 
can apply a known classical theorem to P pa th- From 
Ppath, define conditional probability for £W to in- 



Fx„ ASiU = P(|1 X ) A ) ® i&° 
P m>v = i A ®iMtiM 

F wt) „ = P(|0,) A ) ® ff +P(\U)a)®F^ } 
P P h., = P(\O x ) A )®P(AW\lM) B ) 

+ P(|l x ) A )®P(iWt| W) B ). (A6) 



Here, 1 A = P(|0,) A ) + P(|1 Z ) A ), l£° = PQODb) + 
P(\1^)b), and sec Eqs. © and © for the definitions of 
P^ and Ai , respectively. 



elude {fi, ^} conditioned on U (fc) } fc =i,.'..,z-i, and espe- Havin S P (0 and now we can write down 



cially we define <$, A = ^ and <;n 

thermore, we introduce nn ^ as follows 



sgS- F - 



^n,A 
nn.A 



Cn,A 
1 -t 

?n,A 



for SI = s, fil, bit, ph 
for SI = l x A s , (A2) 



where nn,A = X^ga Then, Azuma's inequality [11| 

states that, since Xq\ = Tq X — J2k=i «i i s martingale 
[13] and satisfies the bounded difference condition [l8| , it 
follows that for any e > and N > 0, 



N 



Prob ( |T n ,A ~ E4°aI >Ne)< 2e~^ 
i=i 



(A3) 



holds [L2j for 17 = s, fil, ph, bit, l x A s. 

Then, for the code pairs, by setting e in Eq. (|A3[) as 
e(l — i), we have 



Prob |An^-£ng A /iV|> e < 2e 



,(A4) 



2 = 1 



where 51 = s, fil, ph, bit, and similarly for the test pairs 
we have 



Prob I A 



n.A 



N 



.(0 



JN\ > e < 2e- 



(A5) 



where 57 = l^As. These inequalities guarantee that in the 
limit of large N with t being fixed, the normalized ver- 
sion of the sum of the probabilities ri^ x /N differs from 
the actual ratio only with exponentially small probabil- 
ity. The next step is to find the relationship among the 
probabilities n[^ A so that we have the relationship among 
the number of the actual events. 

Let pft' be the density operator of the I th pair condi- 
tioned on the previous outcomes {£} '}k=l,...,l-l- Then 
(0 



Tr(pWPn,A) by using the corresponding POVM element 
Pq.a- We have little clue about the identity of pS l > , but we 
may find a relation /({tIq \}q) _• which holds for any 
state p®. If we find such a convex function /, it follows 
that /({Xz=i n n\/N}n) — 0> ano - we obtain a relation 
among {An. a} through Azuma's inequality. Note that 
in the limit of N — > oo, the above relation is simply 

/C{A.,.a!..>: < 0. 

Thus, the derivation of the relation among the condi- 
tional probabilities is the key point in deriving the in- 
equality for the phase error estimation, which we present 
in Appendix B. 



APPENDIX B: DETAILED CALCULATIONS FOR 
THE PHASE ERROR ESTIMATION 

In this appendix, we derive the relation among the 
conditional probabilities x = Tr (p^Pq,\J. In what 
follows, we assume v < 1/R (R is the reflectivity of the 
beam splitter BS1) and Vf < 2 i n (i-_R) ' ^ c n °t c that 
in the actual experiment, these assumptions are well- 
justified, and even if these assumptions do not hold, we 
can construct the relationship by applying slight modi- 
fications. Thus, these assumptions are not essential for 
the proof. 

Since the relationship we derive in this appendix 
holds for any density matrix, we use the abbrevia- 
tion no. a = Tr (pPn,\j , where p is any density op- 
erator. Let us introduce mu\u and n,u\ v — 
0,1) as Tr (pP(|r^) AB )) and Tr (>(^} A |zf >> B )) , 

respectively. Here, |r$> A B = {-if PAQa\i' x v) )b + 

(-l) l ( 4 '+ 1 )a, y |(z + l) ;c ) A |(i' + l)l" ) )B) (the summation 
and multiplication are taken in modulo 2). 

If we regard the subspace 

spanned by {|0 x ) A |0i >) B , 

({IO^aII^^bJUaIO^^b}) as a qubit, then 



can be expressed as n nx = Trfp^pQ^J, where £h e tw0 bases, {\0 x )a IO^^b.IUaII^Jb} and 
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{|r^)ABi )ab}, correspond to two directions 
in the Bloch sphere with relative angle 8^ satisfying 
a 2 v = sin 2 ^"), and /3 2 = cos 2 6^ in [0,tt/2]. Then, for 
any qubit state in the Bloch sphere, we have 



sm 



#° - { ^) < sin 2 ^ < sin 2 (6^ + ffM) , 



(Bl) 



where nn^/Cnii^+noo,!/) = sin 2 Q)p and mii )y /(mu )tf + 
) — sin 2 . Similarly we have 



?(") _ < S in 2 < sin 2 (e M + ; 



(B2) 



where noi,i//("oi,i/+"io,i/) = sm 2 0f^ andmoi, I //(moi, ! /+ 
mio.v) = sin 2 $l • 

In addition, n.n,i/ can be expressed as 



"s,i/ ^ ^ "ii',z/ 

i,i'=0,l 

"i^as,* = ("10,1/ + nii.i/) 
"m,i/ = G v [al(noo, v + nw,u 
+ Pl(noi,u + nil,!/)] 

G 

"bit,!/ = -£-(™>U,V + TOOl,!/) ■ 

Note that Eqs. (|B3jl -(|B6 jl can be represented as 

/ noo.i/ 



(B3) 
(B4) 

(B5) 
(B6) 

(B7) 




where 



C" 1 



/ 1 





"01,1/ 
"-10,1/ 

V mi.i/ 



(B8) 



G„a 2 G U (3 V G v a 2 G u 0l 
\ G./3 2 G.a 2 



(B9) 



By solving Eqs. (|B7j). (jBlj) , and ([B8]) . we have an 
inequality 



"fii.i/ - 2n b it,i/ < 2 G v a u 0u9(Cu2 u ) . 



(BIO) 



Here, <?((a, 6, c, d) T ) = Varf + %/&c and C„ is given by 



/ 



a = 



« 2 °» 



4* pl 



i 

l 



„,2 



G„ / 



(Bll) 



We can overestimate C^Z^ by maximizing each entry 
of C v over v £ A = [i/j, z/f ] to obtain C" = max^g^C^ as 



/ 



C' = 



-0t 
-a 

0t 



2 a lf 1 



"Itfif R2 Pi 



1 

G vf 



\ "f G vf (Pi f - a l f ) G vi J 

(B12) 

Here, we have used the assumption that we choose A 
such that j3 2 > a 2 , i.e., vR < 1, for any v £ A, lead- 

4 

ing to d v (3l < 0, d v a 2 v > 0, d v G v < 0, d v {/3 -y a i) > 

P A a 2 p 2 a 2 



and 



> 0. Furthermore, the condition Vf < 



2in(i-_R) gi yes us dvG v a v fi v > 0, and with the help of 
this inequality, we can slightly modify Eq. (B9) as 



"fii,!/ - 2nbit,r/ < lG Vf a Vf l3 Vf g(C'Z v ) 



(B13) 



Note that if vR < 1 and Vf < 



do not hold, it 



2 ln(l-R) 

just changes the sign of the derivative functions. Thus, 
even in that case, we can construct a matrix similar to 
Eq. (|B12|) by applying appropriate modifications, such 
as the interchange of and vj. Another remark is on 
our assumption i>j < and i/f < ~ 2 i n (i-fl) ■ that 
when i? 1, this condition is approximately equivalent 
^21"^ wn i cn i s natural for standard 

experiments where Bob almost never detects the photon 
number that is greater than the mean photon number 
emitted by Alice due to the channel loss and non-unit 
quantum efficiency of the detectors. Thus, in most of 
normal experiments, the assumptions hold. 

Finally, we take summation over v G A, and with the 
help of the concavity of the function g((a,b,c,d) T ), we 
have 



"fil.A - 2n wt ,A 

i/£A 

< 2G Uf a Uf /3 Vf g(C'J2 z ») 

i/£A 

= 2G Uf a Uf (3 Uf g(C'z x ), 



(B14) 



where 



ZA = 




(B15) 
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APPENDIX C: ESTIMATION OF THE 
PARAMETERS FROM THE EXPERIMENTALLY 
AVAILABLE DATA 

In this appendix, we first express Eq. (|B14[) in terms 
of the actual number of ratio, and then we give the esti- 
mation of the parameters appearing in the resulting in- 
equality to obtain Eq. (|15[) . First, we apply Azuma's 
inequality to z\. In the limit of large AT, z\ is trans- 
formed into the actual ratio of the corresponding events 
Z\ = (A S)A , Ai xASj a, Afli,A, A phiA ) T , and we have 

Afii, A - 2A bit , A < 2G Vf acu f Pv f g(C'Zx) , (CI) 

whereas for finite N, we can bound the probability of 
violating (a slightly relaxed version of) Eq. (|C1[) using 
Eq. (pS} and Eq. (|A5]l . 

The next step is to give the estimation of the vari- 
ables appearing in Eq. (|C1[) from the actually observed 
quantities in the experiment. By considering an inclusion 
relation on A, Agi A can obviously be bounded as 

Afil,A' < Afii^A < Afix.aU 

(C2) 

where we have used A' S A (see Eq. ([13])). Similarly, 
Abit.A is bounded as 

Abit,A' < Abit,A < Abit.all > (C3) 

where we have defined Abigail as the number of the bit 
errors divided by N(l — t) and Abit,A' as that of the bit 
errors divided by N(l — t) with the condition v € A'. 

Next, note that A Sj a is the ratio of events of the suc- 
cessful qubit projection with the total photon number in- 
side A. This ratio is lower-bounded by the ratio of event 
A vac a(D!) where Di detects photons inside A^ Dl ^ and the 
vacuum is detected by D2 and D3 in total, plus the ratio 
of event Ag^A' where Di detects photons inside A^ Dl ' and 
a single-photon is detected by D 2 and D 3 in total. Thus, 
we have 

V\ = A vac,A( D i> + Afii.A' < A s .a < 1 . 

(CM) 

Finally, Ai xAs .a is obviously upper-bounded by Ai x 
that is the ratio for Alice to obtain l x in the test pairs. 



On the other hand, Ai xASi A is lower-bounded from the 
worst case scenario where Alice's X-basis measurement 
results in 1 for all the pairs that have resulted in Bob's 
"N". The ratio of this event is represented by 1 — A^ I, 

where Ag* A is the test-pair- version of A Si A- By the same 
token as Eq. (|C4|) , 1 — A^l is no larger than 1 — fj^' where 

#-A« A(Dl)+ A« A , (06) 

is the test-pair- version of and A^' . (Dl) and Ag^ A , are 
the test-pair-version of A vac A < Dl ) and Ag^A'j respectively. 
Hence, we have 

Ai x -(l-^ t) )<A lxAs ,A<A lx . (06) 
Moreover, by applying the substitutions An, a —> Ai x and 
Uq a — * to Eq. (|A5|) . we have 

Prob (|A lx ~a 2 \>e)< 2e- N ^ 2 / 2 (C7) 

for any N > and e > (see Eq. © for the definition 
of a). Thus, we can bound Ai xASi A by using the experi- 
mentally available data as 

a 2 -(l-r?f) <A lxAs , A <5 2 , (C8) 

which is violated with probability less than 2e~ N ^ I 2 . 

In summary, we have Zl < Za < Zjj, where 
Z L = (fix, a 2 - 1 + ff^, Agi,A', A ph! A) T and Z v = 
(1, a 2 , Agnail, Aph,A) T , and the final expression is de- 
scribed as 

Agi.A' -2Abit,aii < 2G Uf a t/f p Vf g(C' + Zu — C'_Zi,), (09) 

where we have decomposed C = C' + — C'_ such that C, 
includes only the nonnegative entries of C . We remark 
that Eq. (|C9[) uses two parameters ij^ and r)\, whereas 

Eq. (|15p uses only fj\ . Since fj^ and fj\ are the same pa- 
rameter in different random samples, they must be very 
close to each other for large N. Hence it is also possible 
to measure only fj\ in the code pairs and estimate fj^ 
from that. But in practice, there is no additional over- 
head in determining fn' , and thus it is always better to 
use Eq. (|C9[) involving fewer numbers of estimations. 
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